US8589673B2 - Methods and systems for distributing cryptographic data to authenticated recipients - Google Patents
Methods and systems for distributing cryptographic data to authenticated recipients Download PDFInfo
- Publication number
- US8589673B2 US8589673B2 US13/340,732 US201113340732A US8589673B2 US 8589673 B2 US8589673 B2 US 8589673B2 US 201113340732 A US201113340732 A US 201113340732A US 8589673 B2 US8589673 B2 US 8589673B2
- Authority
- US
- United States
- Prior art keywords
- client device
- access control
- management system
- control management
- data object
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 85
- 238000003860 storage Methods 0.000 claims description 22
- 238000007726 management method Methods 0.000 description 182
- 238000004891 communication Methods 0.000 description 14
- 238000010586 diagram Methods 0.000 description 12
- 230000008569 process Effects 0.000 description 8
- 230000006870 function Effects 0.000 description 7
- 238000004590 computer program Methods 0.000 description 6
- 238000012545 processing Methods 0.000 description 6
- 230000005540 biological transmission Effects 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000009434 installation Methods 0.000 description 3
- 230000007246 mechanism Effects 0.000 description 3
- 240000005020 Acaciella glauca Species 0.000 description 2
- 238000003491 array Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 2
- 235000003499 redwood Nutrition 0.000 description 2
- 238000011160 research Methods 0.000 description 2
- 230000001360 synchronised effect Effects 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- IRLPACMLTUPBCL-KQYNXXCUSA-N 5'-adenylyl sulfate Chemical compound C1=NC=2C(N)=NC=NC=2N1[C@@H]1O[C@H](COP(O)(=O)OS(O)(=O)=O)[C@@H](O)[C@H]1O IRLPACMLTUPBCL-KQYNXXCUSA-N 0.000 description 1
- 101000666896 Homo sapiens V-type immunoglobulin domain-containing suppressor of T-cell activation Proteins 0.000 description 1
- 241000699666 Mus <mouse, genus> Species 0.000 description 1
- 241000699670 Mus sp. Species 0.000 description 1
- 102100038282 V-type immunoglobulin domain-containing suppressor of T-cell activation Human genes 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 235000014510 cooky Nutrition 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000009826 distribution Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000000802 evaporation-induced self-assembly Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- IJJVMEJXYNJXOJ-UHFFFAOYSA-N fluquinconazole Chemical compound C=1C=C(Cl)C=C(Cl)C=1N1C(=O)C2=CC(F)=CC=C2N=C1N1C=NC=N1 IJJVMEJXYNJXOJ-UHFFFAOYSA-N 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000002085 persistent effect Effects 0.000 description 1
- 230000001902 propagating effect Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000000859 sublimation Methods 0.000 description 1
- 230000005641 tunneling Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/305—Authentication, i.e. establishing the identity or authorisation of security principals by remotely controlling device operation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/33—User authentication using certificates
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
- H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
- H04N21/4627—Rights management associated to the content
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2107—File encryption
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2115—Third party
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/60—Digital content management, e.g. content distribution
- H04L2209/603—Digital right managament [DRM]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/101—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying security measures for digital rights management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
Definitions
- symmetric key cryptography e.g., the Advanced Encryption Standard (AES) in the United States
- AES Advanced Encryption Standard
- a method for distributing cryptographic data to authenticated recipients includes receiving, by an access control management system, from a first client device, information associated with an encrypted data object.
- the method includes receiving, by the access control management system, from a second client device, a request for the information associated with the encrypted data object.
- the method includes verifying, by the access control management system, that a user of the second client device is identified in the received information associated with the encrypted data object.
- the method includes authenticating, by the access control management system, with an identity provider, the user of the second client device.
- the method includes sending, by the access control management system, to the second client device, the received information associated with the encrypted data object.
- FIG. 2A is a block diagram depicting an embodiment of a system for distributing cryptographic data to authenticated recipients
- FIG. 2B is a block diagram depicting an embodiment of a system for distributing cryptographic data including a plurality of access control management systems
- FIG. 2C is a block diagram depicting an embodiment of a system for distributing cryptographic data including an application for generating secure document information
- the methods and systems described herein relate to distributing cryptographic data to authenticated recipients. Before describing these methods and systems in detail, however, a description is provided of a network in which such methods and systems may be implemented.
- the network environment comprises one or more clients 102 a - 102 n (also generally referred to as local machine(s) 102 , client(s) 102 , client node(s) 102 , client machine(s) 102 , client computer(s) 102 , client device(s) 102 , computing device(s) 102 , machine(s) 102 , endpoint(s) 102 , or endpoint node(s) 102 ) in communication with one or more remote machines 106 a - 106 n (also generally referred to as server(s) 106 , machine(s) 106 , or computing device(s) 106 ) via one or more networks 104 .
- clients 102 a - 102 n also generally referred to as local machine(s) 102 , client(s) 102 , client node(s) 102 , client machine(s) 102 , client computer(s) 102 , client device(s) 102 , computing device(s
- FIG. 1A shows a network 104 between the clients 102 and the remote machines 106
- the network 104 can be a local-area network (LAN), such as a company Intranet, a metropolitan area network (MAN), or a wide area network (WAN), such as the Internet or the World Wide Web.
- LAN local-area network
- MAN metropolitan area network
- WAN wide area network
- a network 104 ′ (not shown) may be a private network and a network 104 may be a public network.
- a network 104 may be a private network and a network 104 ′ a public network.
- networks 104 and 104 ′ may both be private networks.
- the network 104 may be any type and/or form of network and may include any of the following: a point to point network, a broadcast network, a wide area network, a local area network, a telecommunications network, a data communication network, a computer network, an ATM (Asynchronous Transfer Mode) network, a SONET (Synchronous Optical Network) network, a SDH (Synchronous Digital Hierarchy) network, a wireless network and a wireline network.
- the network 104 may comprise a wireless link, such as an infrared channel or satellite band.
- the topology of the network 104 may be a bus, star, or ring network topology.
- the network 104 may be of any such network topology as known to those ordinarily skilled in the art capable of supporting the operations described herein.
- the network may comprise mobile telephone networks utilizing any protocol or protocols used to communicate among mobile devices, including AMPS, TDMA, CDMA, GSM, GPRS or UMTS.
- AMPS AMPS
- TDMA Time Division Multiple Access
- CDMA Code Division Multiple Access
- GSM Global System for Mobile communications
- GPRS Global System for Mobile communications
- UMTS Universal Mobile communications
- a client 102 and a remote machine 106 can be any workstation, desktop computer, laptop or notebook computer, server, portable computer, mobile telephone or other portable telecommunication device, media playing device, a gaming system, mobile computing device, or any other type and/or form of computing, telecommunications or media device that is capable of communicating on any type and form of network and that has sufficient processor power and memory capacity to perform the operations described herein.
- a client 102 may execute, operate or otherwise provide an application, which can be any type and/or form of software, program, or executable instructions, including, without limitation, any type and/or form of web browser, web-based client, client-server application, an ActiveX control, or a Java applet, or any other type and/or form of executable instructions capable of executing on client 102 .
- an application can be any type and/or form of software, program, or executable instructions, including, without limitation, any type and/or form of web browser, web-based client, client-server application, an ActiveX control, or a Java applet, or any other type and/or form of executable instructions capable of executing on client 102 .
- a computing device 106 provides functionality of a web server.
- a web server 106 comprises an open-source web server, such as the APACHE servers maintained by the Apache Software Foundation of Delaware.
- the web server executes proprietary software, such as the Internet Information Services products provided by Microsoft Corporation of Redmond, Wash., the Oracle iPlanet web server products provided by Oracle Corporation of Redwood Shores, Calif., or the BEA WEBLOGIC products provided by BEA Systems, of Santa Clara, Calif.
- FIGS. 1B and 1C depict block diagrams of a computing device 100 useful for practicing an embodiment of the client 102 or a remote machine 106 .
- each computing device 100 includes a central processing unit 121 , and a main memory unit 122 .
- a computing device 100 may include a storage device 128 , an installation device 116 , a network interface 118 , an I/O controller 123 , display devices 124 a - n , a keyboard 126 , a pointing device 127 , such as a mouse, and one or more other I/O devices 130 a - n .
- the storage device 128 may include, without limitation, an operating system and software.
- the central processing unit 121 is any logic circuitry that responds to and processes instructions fetched from the main memory unit 122 .
- the central processing unit 121 is provided by a microprocessor unit, such as: those manufactured by Intel Corporation of Mountain View, Calif.; those manufactured by Motorola Corporation of Schaumburg, Ill.; those manufactured by Transmeta Corporation of Santa Clara, Calif.; those manufactured by International Business Machines of White Plains, N.Y.; or those manufactured by Advanced Micro Devices of Sunnyvale, Calif.
- the computing device 100 may be based on any of these processors, or any other processor capable of operating as described herein.
- Main memory unit 122 may be one or more memory chips capable of storing data and allowing any storage location to be directly accessed by the microprocessor 121 .
- the main memory 122 may be based on any available memory chips capable of operating as described herein.
- the processor 121 communicates with main memory 122 via a system bus 150 .
- FIG. 1C depicts an embodiment of a computing device 100 in which the processor communicates directly with main memory 122 via a memory port 103 .
- FIG. 1C also depicts an embodiment in which the main processor 121 communicates directly with cache memory 140 via a secondary bus, sometimes referred to as a backside bus. In other embodiments, the main processor 121 communicates with cache memory 140 using the system bus 150 .
- the processor 121 communicates with various I/O devices 130 via a local system bus 150 .
- Various buses may be used to connect the central processing unit 121 to any of the I/O devices 130 , including a VESA VL bus, an ISA bus, an EISA bus, a MicroChannel Architecture (MCA) bus, a PCI bus, a PCI-X bus, a PCI-Express bus, or a NuBus.
- MCA MicroChannel Architecture
- PCI bus PCI bus
- PCI-X bus PCI-X bus
- PCI-Express PCI-Express bus
- NuBus NuBus.
- the processor 121 may use an Advanced Graphics Port (AGP) to communicate with the display 124 .
- FIG. 1C depicts an embodiment of a computer 100 in which the main processor 121 also communicates directly with an I/O device 130 b via, for example, HYPERTRANSPORT, RAPIDIO, or INFINIBAND communications technology.
- the computing device 100 may support any suitable installation device 116 , such as a floppy disk drive for receiving floppy disks such as 3.5-inch, 5.25-inch disks or ZIP disks, a CD-ROM drive, a CD-R/RW drive, a DVD-ROM drive, tape drives of various formats, USB device, hard-drive or any other device suitable for installing software and programs.
- the computing device 100 may further comprise a storage device, such as one or more hard disk drives or redundant arrays of independent disks, for storing an operating system and other software.
- the computing device 100 may include a network interface 118 to interface to the network 104 through a variety of connections including, but not limited to, standard telephone lines, LAN or WAN links (e.g., 802.11, T1, T3, 56 kb, X.25, SNA, DECNET), broadband connections (e.g., ISDN, Frame Relay, ATM, Gigabit Ethernet, Ethernet-over-SONET), wireless connections, or some combination of any or all of the above.
- standard telephone lines LAN or WAN links (e.g., 802.11, T1, T3, 56 kb, X.25, SNA, DECNET), broadband connections (e.g., ISDN, Frame Relay, ATM, Gigabit Ethernet, Ethernet-over-SONET), wireless connections, or some combination of any or all of the above.
- LAN or WAN links e.g., 802.11, T1, T3, 56 kb, X.25, SNA, DECNET
- broadband connections e.g., ISDN, Frame Relay
- Connections can be established using a variety of communication protocols (e.g., TCP/IP, IPX, SPX, NetBIOS, Ethernet, ARCNET, SONET, SDH, Fiber Distributed Data Interface (FDDI), RS232, IEEE 802.11, IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, CDMA, GSM, WiMax and direct asynchronous connections).
- the computing device 100 communicates with other computing devices 100 ′ via any type and/or form of gateway or tunneling protocol such as Secure Socket Layer (SSL) or Transport Layer Security (TLS).
- SSL Secure Socket Layer
- TLS Transport Layer Security
- the computing device 100 may comprise or be connected to multiple display devices 124 a - 124 n , which each may be of the same or different type and/or form.
- any of the I/O devices 130 a - 130 n and/or the I/O controller 123 may comprise any type and/or form of suitable hardware, software, or combination of hardware and software to support, enable or provide for the connection and use of multiple display devices 124 a - 124 n by the computing device 100 .
- a computing device 100 may be configured to have multiple display devices 124 a - 124 n.
- a computing device 100 of the sort depicted in FIGS. 1B and 1C typically operates under the control of operating systems, which control scheduling of tasks and access to system resources.
- the computing device 100 can be running any operating system such as any of the versions of the MICROSOFT WINDOWS operating systems, the different releases of the Unix and Linux operating systems, any version of the MAC OS for Macintosh computers, any embedded operating system, any real-time operating system, any open source operating system, any proprietary operating system, any operating systems for mobile computing devices, or any other operating system capable of running on the computing device and performing the operations described herein.
- Typical operating systems include, but are not limited to: WINDOWS 3.x, WINDOWS 95, WINDOWS 98, WINDOWS 2000, WINDOWS NT 3.51, WINDOWS NT 4.0, WINDOWS CE, WINDOWS XP, WINDOWS 7 and WINDOWS VISTA, all of which are manufactured by Microsoft Corporation of Redmond, Wash.; MAC OS, manufactured by Apple Inc., of Cupertino, Calif.; OS/2, manufactured by International Business Machines of Armonk, N.Y.; or any type and/or form of a Unix operating system.
- the computing device 100 can be any workstation, desktop computer, laptop or notebook computer, server, portable computer, mobile telephone or other portable telecommunication device, media playing device, a gaming system, mobile computing device, or any other type and/or form of computing, telecommunications or media device that is capable of communication and that has sufficient processor power and memory capacity to perform the operations described herein.
- the computing device 100 may have different processors, operating systems, and input devices consistent with the device.
- the computing device 100 is a mobile device, such as a JAVA-enabled cellular telephone or personal digital assistant (PDA).
- PDA personal digital assistant
- the computing device 100 may be a mobile device such as those manufactured, by way of example and without limitation, by Motorola Corp.
- the computing device 100 is a digital audio player.
- the computing device 100 is a digital audio player such as the Apple IPOD, IPOD Touch, IPOD NANO, and IPOD SHUFFLE lines of devices, manufactured by Apple Inc., of Cupertino, Calif.
- the digital audio player may function as both a portable media player and as a mass storage device.
- the computing device 100 is a digital audio player such as those manufactured by, for example, and without limitation, Samsung Electronics America, of Ridgefield Park, N.J., Motorola Inc. of Schaumburg, Ill., or Creative Technologies Ltd. of Singapore.
- the computing device 100 is a portable media player or digital audio player supporting file formats including, but not limited to, MP3, WAV, M4A/AAC, WMA Protected AAC, AEFF, Audible audiobook, Apple Lossless audio file formats and .mov, .m4v, and .mp4 MPEG-4 (H.264/MPEG-4 AVC) video file formats.
- file formats including, but not limited to, MP3, WAV, M4A/AAC, WMA Protected AAC, AEFF, Audible audiobook, Apple Lossless audio file formats and .mov, .m4v, and .mp4 MPEG-4 (H.264/MPEG-4 AVC) video file formats.
- the computing device 100 comprises a combination of devices, such as a mobile phone combined with a digital audio player or portable media player.
- the computing device 100 is a device in the Motorola line of combination digital audio players and mobile phones.
- the computing device 100 is device in the iPhone smartphone line of devices, manufactured by Apple Inc., of Cupertino, Calif.
- the computing device 100 is a device executing the Android open source mobile phone platform distributed by the Open Handset Alliance; for example, the device 100 may be a device such as those provided by Samsung Electronics of Seoul, Korea, or HTC Headquarters of Taiwan, R.O.C.
- the computing device 100 is a tablet device such as, for example and without limitation, the iPad line of devices, manufactured by Apple Inc.; the PlayBook, manufactured by Research in Motion; the Cruz line of devices, manufactured by Velocity Micro, Inc., of Richmond, Va.; the Folio and Thrive line of devices, manufactured by Toshiba America Information Systems, Inc., of Irvine, Calif.: the Galaxy line of devices, manufactured by Samsung; the HP Slate line of devices, manufactured by Hewlett-Packard; and the Streak line of devices, manufactured by Dell, Inc., of Round Rock, Tex.
- the iPad line of devices manufactured by Apple Inc.
- the PlayBook manufactured by Research in Motion
- the Cruz line of devices manufactured by Velocity Micro, Inc., of Richmond, Va.
- the Folio and Thrive line of devices manufactured by Toshiba America Information Systems, Inc., of Irvine, Calif.
- the Galaxy line of devices manufactured by Samsung
- the HP Slate line of devices manufactured by Hewlett-Packard
- Streak line of devices manufactured by Dell, Inc
- the methods and systems described herein provide functionality allowing a user to specify individuals who may access a data object regardless of whether the recipients are members of the same access control management system as the user, or of any access control management system at all.
- the methods and systems described herein provide functionality allowing a user to distribute a secured data object via a non-secured channel and distribute the cryptographic data for accessing the secured data object via a separate, secure channel, where authentication, access control, and establishment of the secure channel is implemented by an access control management system; an authorized recipient can authenticate himself through a third-party identity provider, receive delivery of cryptographic data from the access control management system, and access the data object.
- the methods and systems described herein provide for the decoupling of access control and authentication from data storage and distribution.
- FIG. 2A a block diagram depicts one embodiment of a system for distributing cryptographic data to authenticated recipients.
- the system includes an access control management system 202 , an identity provider 204 , machines 106 a - n , client devices 102 a - n , an encrypted data object 206 , and information 208 associated with the encrypted data object 206 .
- the client devices 102 a - n are clients 102 as described above in connection with FIGS. 1A-C .
- the access control management system 202 and the identity provider 204 execute on machine 106 a - n .
- the machines 106 a - n may be remote machines 106 , as described above in connection with FIGS. 1A-C .
- the machines 106 and client devices 102 exchange data via networks 104 as described above in connection with FIG. 1A-1C .
- FIG. 2B a block diagram depicts an embodiment of a system for distributing cryptographic data including a plurality of access control management systems.
- the system 200 from FIG. 2A includes a plurality of access control management systems 202 a - n (referred to generally as access control management systems 202 ) and a plurality of identity providers 204 a - n (referred to generally as identity providers 204 ).
- access control management systems 202 access control management systems 202
- identity providers 204 a plurality of identity providers 204 a - n
- a block diagram depicts an embodiment of a system 200 for distributing cryptographic data including a secure object information generator 210 and a secure object information reader 212 .
- the secure object information generator 210 is a software application executing on the client device 102 a with which a user of the client device 102 a may generate the information 208 associated with the encrypted data object 206 ; for example, and without limitation, the secure object information generator 210 may be provided as a stand-alone software application or as a plug-in or add-on to software executing on the client device 102 a .
- the user of the client device 102 a executes the secure object information generator 210 to encrypt a document, thus generating the encrypted data object 206 .
- a data object may be a document of any type, media file of any type, or other data object.
- the data object is data in a format that natively supports encryption (e.g., PDF, compressed files, files generating using a word processing application such as, by way of example the MICROSOFT WORD application).
- the data object is data in a format that does not natively support encryption.
- the encrypted data object 206 includes a document in a self-describing format (e.g., an eXtended Markup Language (XML) format) that supports strong symmetric encryption, digital signatures via asymmetric encryption, unique identifiers, and data objects (e.g., documents, images multimedia, Portable Document Format (PDF) documents).
- a self-describing format e.g., an eXtended Markup Language (XML) format
- XML eXtended Markup Language
- data objects e.g., documents, images multimedia, Portable Document Format (PDF) documents.
- PDF Portable Document Format
- an encrypted data object 206 includes a unique identifier, a display name, and an identification of a type of the data object.
- the encrypted data object 206 includes an identifier of the access control management system 202 .
- the secure object information generator 210 includes the identifier (which may be provided, for example, and without limitation, as a uniform resource locator) and the computing device 102 b uses the identifier to request the information 208 from the access control management system 202 .
- the identifier of the access control management system 202 is included in an unencrypted portion of the encrypted data object 206 , such as an unencrypted header.
- the secure object information generator 210 includes functionality for encrypting data objects. In one of these embodiments, the secure object information generator 210 includes at least one encryption engine for encrypting or decrypting data objects. In other embodiments, the secure object information generator 210 generates an identifier for the encrypted data object 210 and includes the identifier in the information 208 that is transmitted to the access control management system 202 . In other embodiments, the secure object information generator 210 requests that the access control management system 202 generate an identifier for the encrypted data object 206 .
- the secure object information generator 210 processes a data object to generate an encrypted data object 206 and information 208 associated with the encrypted data object 206 .
- the information 208 may be, for example, a registration payload containing information such as an encryption key used to encrypt the data object 206 and an access control list specifying users who may receive the encryption key to decrypt the data object 206 .
- the information 208 includes at least one identification of a user authorized to receive the encryption key; for example, the information 208 includes an email address for each authorized user.
- the information 208 includes an identifier of computing devices that are authorized to receive the information 208 .
- the user of the first computing device 102 a may specify that a second user may receive the information 208 only at a specific machine (for example, prohibiting the second user from accessing the information 208 from a mobile device or public kiosk); alternatively, the user of the first computing device 102 a may specify that any user of a particular machine may access the information 208 (for example, allowing all members of a department including a secured machine may access the information 208 ).
- the information 208 includes an identification of an authorized machine that may be any machine 102 or 106 as described above in connection with FIGS. 1A-1C .
- the information 208 includes an identification of an authorized machine that complies with the Trusted Platform Module Specification promulgated by the Trusted Computing Group of Beaverton, Oreg., USA.
- a user of the first computing device 102 a may indicate that the access control management system 202 need not authenticate users of the authorized machine because the machine itself has certain properties that allows the user to trust that the machine has been secured.
- the information 208 includes an authorized user group instead of or in addition to authorizing a specific user; for example, the information 208 may specify a particular department, company, entity, or other plurality of users authorized to receive the information 208 .
- the information 208 includes an indication that an authorized user may delegate access; for example, a sending user may specify that a receiving user (such as a doctor) may delegate access to other users (such as a nurse, hospital administrator, resident, or other colleague) and the sending user may specify characteristics of authorized individuals to which the authorized user may delegate access (e.g., anyone with an email address ending in “@HypotheticalHospital.org”).
- the information 208 includes a time-based restriction; for example, a user may specify that an identified second user may receive the information 208 within certain time periods (e.g., during a presentation, a consultation, a joint venture, and an arbitrary time frame).
- the information 208 may be generated separately from the encrypted data object 206 and transmitted separately from the encrypted data object 206 .
- the information 208 includes a specification of data rights protection mechanisms to execute for the encrypted data object 206 , including whether the encrypted data object 206 is permitted to be copied, pasted, forwarded by email or otherwise distributed to other unauthorized recipients, printed and/or screen-printed with or without embedding hidden “watermarks” in the data object for use in tracing information back to the application 210 or 212 that opened the data object 206 , each of which are functions that the system is able to prohibit when the encrypted data object 206 is later opened by an authorized user.
- the user of the first computing device 102 a may prevent “print screen” in operating systems that otherwise support the print screen function; if the user wishes to prevent print screen, instructions to activate an existing digital rights management program including such countermeasures can be included in the information 208 , in which case the countermeasure will be activated when an authorized recipient user decrypts the encrypted data object 206 .
- the secure object information reader 212 allows a user to access information 208 generated by the secure object information generator 210 .
- the secure object information reader 212 includes functionality allowing a user to communicate with the access control management system 202 and the identity provider 204 to authenticate himself in order to receive information 208 .
- the secure object information generator 210 includes at least one encryption engine for encrypting or decrypting data objects.
- the secure object information generator 210 and the secure object information reader 212 are provided as application plug-ins, web services, or stand-alone applications.
- the access control management system 202 enables access control using decentralized identity management, relying on external identity providers to authenticate user identity.
- the access control management system 202 includes functionality for accessing information 208 generated by a secure object information generator 210 .
- the access control management system 202 may include a secure object information reader 212 that receives and processes the information 208 .
- the access control management system 202 includes an identity provider selector 214 identifying a plurality of identity providers 204 and selecting one of the plurality of identity providers 204 for authentication of a user of a client device 102 b .
- the identity provider selector 214 may receive an enumeration of user identifiers from the secure object information reader 212 and analyze each enumerated user identifier in the enumeration to determine which identity providers 204 to access for authentication of each enumerated user identifier; for instance, by analyzing a domain name included in the user identifier and querying a database to identify an identity provider 204 associated with the analyzed domain name.
- the access control management system 202 uses an interface to the identity provider 204 through which the access control management system 202 may make authentication requests.
- the access control management system 202 may establish an interface to an identity provider 204 that provides an interface according to a federated identity standard such as OpenID, Information Card (InfoCard), or SAML standards.
- the access control management system 202 includes functionality for communicating with identity providers using different communications standards.
- the access control management system 202 includes functionality for verifying that the user of the second client device 102 b is identified in the received information associated with the encrypted data object. For example, the access control management system 202 may include functionality for analyzing the received information 208 to determine whether the information 208 includes an identifier of the user. As another example, the access control management system 202 may include functionality for analyzing an access control list included in the received information 208 to determine whether the user is on the access control list.
- the access control management system 202 supports Role-Based Access Control (RBAC).
- RBAC is an existing access control framework in which access to files is controlled by virtue of the roles a user has been assigned rather than the user's personal identity.
- the access control management system 202 the information 208 includes identified properties or roles, and the access control management system 202 makes an access control decision based on whether a user has an authorized property or role.
- the access control management system 202 includes a transaction log in which it stores an identification of at least one of: transactions, users, groups, roles, information 208 associated with each user, policies and business rules. In one of these embodiments, the access control management system 202 issues unique identifiers for data objects, transmitting the unique identifier to the secure object information generator 210 that generates the information 208 .
- the access control management system 202 By tracking access requests, both valid and invalid, usage statistics can be gathered about who is accessing data and for how long, as well as from where unauthorized access attempts are being made. This capability can enable data owners or stewards to understand what data objects are useful, as well as who they may want to add or remove from their access control lists.
- the method 300 includes receiving, by an access control management system, from a first client device, information associated with an encrypted data object ( 302 ).
- the method 300 includes receiving, by the access control management system, from a second client device, a request for the information associated with the encrypted data object ( 304 ).
- the method 300 includes verifying, by the access control management system, that a user of the second client device is identified in the received information associated with the encrypted data object ( 306 ).
- the method 300 includes authenticating, by the access control management system, with an identity provider, the user of the second client device ( 308 ).
- the method 300 includes sending, by the access control management system, to the second client device, the received information associated with the encrypted data object ( 310 ).
- the access control management system receives, from a first client device, information associated with an encrypted data object ( 302 ).
- a user of the first client device 102 executes the secure object information generator 210 to encrypt the data object 206 and generate the information 208 .
- the secure object information generator 210 generates the information 208 based upon information provided by the user of the first client device 102 a .
- the information 208 includes an identifier of the data object 206 , cryptographic data associated with the encrypted data object 206 (e.g., a key for decrypting the encrypted data object 206 ), and an identification of each individual authorized to receive the cryptographic data.
- the information 208 includes an identifier of the data object 206 and cryptographic data associated with the encrypted data object 206 (e.g., a key for decrypting the encrypted data object 206 ).
- the user of the first client device 102 a may provide the identification of each individual authorized to receive the cryptographic data separately from the information 208 .
- the secure object information generator 210 includes an encryption engine used to generate the cryptographic data.
- the secure object information generator 210 executes an encryption engine on the computing device 102 a , which generates the cryptographic data.
- the access control management system 202 receives the information 208 from the first client device 102 a via an interface between the secure object information generator 210 executing on the first client device 102 a and the secure object information reader 212 executing on the access control management system 202 .
- the secure object information generator 210 executing on the first client device 102 a and the secure object information reader 212 use Secure Socket Layers (SSL) or Transport Layer Security (TLS) to communicate.
- the access control management system 202 and the first client device 102 a establish a secure connection for transmission of the information 208 independently of the secure object information generator 210 and the secure object information reader 212 .
- the access control management system 202 receives an indication that the first client device 102 a selected the access control management system 202 from a plurality of access control management systems 202 a - n for storage of the information 208 associated with the encrypted data object 206 . In one of these embodiments, the access control management system 202 receives the indication from the first client device 102 a.
- the access control management system 202 authenticates a user of the first client device 102 a .
- the access control management system 202 may authenticate the user of the first client device 102 a upon receiving a notification that the first client device 102 a selected the access control management system 202 from a plurality of access control management systems 202 a - n for storage of the information 208 associated with the encrypted data object 206 .
- the access control management system 202 authenticates the user of the first client device 102 a with the identity provider 204 .
- the access control management system 202 identifies a second identity provider 204 b to authenticate the user of the first client device 102 a .
- the access control management system 202 uses an interface provided by the secure object information reader 212 to communicate with the secure object information generator 210 executing on the first client device 102 a via an interface and authenticates the user of the first client device 102 a via the interface.
- the access control management system 202 may use Secure Socket Layers (SSL) or Transport Layer Security (TLS) to communicate with the first client device 102 a.
- SSL Secure Socket Layers
- TLS Transport Layer Security
- the access control management system 202 and the first client device 102 a exchange a shared secret key.
- the first client device 102 a encrypts the information 208 associated with the encrypted data object 206 with the shared secret key.
- the first client device 102 a transmits the encrypted information 208 to the access control management system 202 .
- the secure object information generator 210 executing on the first client device 102 a includes a public key associated with the access control management system 202 with which the first client device 102 a may establish a secure connection to the access control management system 202 .
- the access control management system 202 establishes a secure communication channel with the first client device 102 a through the use of well-established key exchange protocols.
- the access control management system 202 receives information including a user identifier associated with the user of the second client device 102 b . In one of these embodiments, the access control management system 202 selects the identity provider 204 a with which to authenticate the user of the second client device 102 b from a plurality of identity providers 204 a - n , based on the received user identifier.
- the access control management system 202 provides an interface with the user of the first client device 102 a can modify the information 208 stored by the access control management system 202 .
- the user of the first client device 102 a generates a modified version of the information 208 and transmits the modified version to the access control management system 202 .
- the ability to modify an existing enumeration of authorized users within the information 208 allows users to add or revoke access quickly—such as when employees are being hired or fired or consultants are provided with short-term access to secure data.
- the access control management system 202 stores the received information 208 in a database.
- the database is an ODBC-compliant database.
- the database may be provided as an ORACLE database, manufactured by Oracle Corporation of Redwood Shores, Calif.
- the database can be a Microsoft ACCESS database or a Microsoft SQL server database, manufactured by Microsoft Corporation of Redmond, Wash.
- the database may be a custom-designed database based on an open source database, such as the MYSQL family of freely available database products distributed by MySQL AB Corporation of Uppsala, Sweden.
- examples of databases include, without limitation, structured storage (e.g., NoSQL-type databases and BigTable databases), HBase databases distributed by The Apache Software Foundation of Forest Hill, Md., MongoDB databases distributed by 10Gen, Inc., of New York, N.Y., and Cassandra databases distributed by The Apache Software Foundation of Forest Hill, Md.
- the database may be any form or type of database.
- the access control management system receives, from a second client device, a request for the information associated with the encrypted data object ( 304 ).
- the second client device 102 b transmits the request to the access control management system 202 after receiving an instruction from the first client device 102 a to transmit the request.
- the first client device 102 a transmits the encrypted data object to the second client device 102 b .
- a user of the first client device 102 a may send an instruction to the user of the second client device 102 b , for example, and without limitation, via electronic communication such as an electronic mail message (e.g., “email”) or message sent via a short message service protocol (e.g., “text message”).
- the user of the first client device 102 a may send a message to the user of the second client device 102 b including the encrypted data object and an instruction to retrieve cryptographic data for decrypting the document from the access control management system 202 (e.g., by including a uniform resource locator (URL) in the message to provide a link to the access control management system 202 ).
- the user of the second client device 102 b attempts to access the encrypted data object 206 , the user is instructed to execute the secure object information reader 212 , which may automatically begin the process of establishing authenticating the user to and establishing a secure connection with the access control management system 202 .
- the user of the second client device 102 b includes an identifier of the identity provider 204 with the request for the information 208 .
- the user of the second client device 102 b is not required to have an account or a previous relationship of any kind with the access control management system 202 ; the relationship the user of the second client device 102 has with an identity provider 204 suffices to authenticate the user, as described in further detail below.
- the access control management system 202 transmits to the second client device 102 b a message (e.g., an email message) containing a secured link to the access control management system 202 and allow the user of the second client device 102 b to establish an account.
- identity providers e.g., popular providers such as Google, Inc., of Mountain View, Calif., USA, and AOL, Inc., of Dulles, Va., USA, implement the OpenID standard and thus are also identity providers 204 ).
- the access control management system verifies that a user of the second client device is identified in the received information associated with the encrypted data object ( 306 ).
- the received information 208 includes an access control list identifying users to which the access control management system 202 may forward the information 208 .
- the access control management system 202 includes distributed functionality for verifying that the user of the second client device 102 b is identified in the received information 208 .
- the functionality provided by the access control management system 202 is distributed across a plurality of machines 106 .
- the access control management system 202 may perform a role-based evaluation of the user of the second client device 102 b ; for instance, the access control management system 202 may execute a first component for verifying that the user of the second client device 102 b is identified in the received information 208 and may execute a second component for verifying that a role associated with the user is a role identified in the information 208 .
- the information 208 may specify that cardiologists at a particular hospital may receive a subset of the information 208 (e.g., the cryptographic key) and the user of the second client device 102 b may indicate he is a doctor at the particular hospital; the first component may verify that the hospital is listed in the information 208 and the second component may verify that the doctor is a cardiologist at the hospital.
- the first component and the second component may be executed on the same or different machines.
- the first component may execute on the machine 106 a with the access control management system 202 while the second component executes on a machine 106 c located at the hospital and in communication with the machine 106 a .
- the access control management system 202 executing on the machine 106 a includes the functionality of both the first component and the second component.
- the access control management system 202 includes a policy information point.
- the access control management system 202 includes a policy decision point.
- the access control management system 202 , the first component and the second component may execute functionality for evaluating and enforcing policies.
- the access control management system authenticates, with an identity provider, the user of the second client device ( 308 ).
- the system 200 may include a plurality of identity providers 204 from which the access control management system 202 identifies an identity provider 204 that can authenticate the user of the second client device 102 b .
- the access control management system 202 determines that the identity provider 204 stores authentication information for the user of the second client device 102 b , based on a user identifier.
- the information 208 may include the user identifier.
- the access control management system 202 sends a request to the identity provider 204 to authenticate the user of the second client device 102 b ; the identity provider 204 then communicates with the second client device 102 b to authenticate the user.
- the identity provider 204 may request that the user of the second client device 102 b transmit a username and password to the identity provider 204 to complete the authentication process.
- the identity provider 204 may use any method for authenticating the user; by way of example, and without limitation, the identity provider 204 may implement authentication techniques relying on biometrics, hardware tokens, one-time password fobs, and smart-phone codes, as well as authentication techniques based on identities of the client devices.
- the access control management system 202 retrieves a user identifier (such as an email address) from the information 208 and identifies the identity provider 204 that can authenticate the user of the second client device 102 b based on the user identifier.
- the access control management system 202 uses a domain name within the user identifier (e.g., the portion of an email address located after the @ symbol) to look up the identity provider 204 .
- the access control management system 202 accesses a database to look up the identity provider 204 (e.g., a database hosted by the access control management system 202 or by a third party).
- the user of the second client device 102 b provides the access control management system 202 with a URL (e.g., a fully qualified OpenID URL) that directs the access control management system 202 to a resource hosted by the identity provider 204 that can be used by the access control management system 202 to initiate the authentication process.
- a URL e.g., a fully qualified OpenID URL
- discovery of the identity provider 204 is not required since the identity provider 204 is explicitly identified in the URL.
- the user of the second client device 102 b provides personally identifiable information to the access control management system 202 (e.g., the URL or a portion thereof).
- an individual other than the intended user accesses the user's client device 102 , opens the secure object information generator 210 or the secure object information reader 212 and tries to open a data object 206 , that individual will need to know the user's identifying information as maintained by the identity provider 204 (e.g., the user's email password), or fulfill other authentication criteria, in order to receive authentication. In this manner, protection is provided against hackers or thieves gaining access to protected files.
- the identity provider 204 e.g., the user's email password
- incorporating the methods and systems described herein adds an additional layer of protection by separating the locations at which the following reside: (1) the encrypted data object 206 , (2) the information 208 , and (3) the authentication information with which the user of the second client device 102 b authenticates himself to the identity provider 204 ; for example, neither the encrypted data object 206 nor the authentication information reside on the access control management system 202 .
- the access control management system sends, to the second client device, the received information associated with the encrypted data object ( 310 ).
- the access control management system 202 establishes a secure connection to the second client device 102 b upon authentication of the user of the second client device 102 b .
- the secure object information reader 212 executing on the second client device 102 b includes a public key associated with the access control management system 202 with which the second client device 102 b may establish a secure connection to the access control management system 202 .
- the access control management system 202 establishes a secure communication channel with the second client device 102 b through the use of well-established key exchange protocols.
- the second client device 102 b sends an identification of the encrypted data object 206 to the access control management system 202 with the request for the information 208 over the established communications channel.
- the access control management system 202 sends all of the received information 208 to the second client device 102 b . In other embodiments, the access control management system 202 sends a subset of the received information 208 to the second client device 102 b . For example, where the received information 208 includes an access control list and a cryptographic key, the access control management system 202 may send just the cryptographic key to the second client device 102 b , or the access control management system 202 may send both the access control list and the cryptographic key. In one embodiment, the second client device 102 b decrypts the encrypted data object 206 with a cryptographic key included in the received information 208 associated with the encrypted data object 206 .
- the cryptographic key is not accessed by the user of the second client device 102 b but delivered to trusted services and applications in memory 122 .
- the cryptographic key is not stored in storage 128 of the second client device 102 b , to prevent the user of the second client device 102 b from accessing the cryptographic key directly.
- cryptographic keys are delivered in a persistent ticket (much like a web cookie). In this way, users have the ability to decrypt an encrypted data object 206 for viewing even if there is no network access to the access control management system 202 .
- the access control management system 202 uses the same identity provider 204 for authenticating each user who requests access to the information 208 . In other embodiments, the access control management system 202 uses different identity providers 204 to authenticate different users. In one of these embodiments, the access control management system 202 selects a first identity provider 204 a to authenticate a user of the second client device 102 b . In another of these embodiments, the access control management system 202 receives, from a third client device 102 c , a request for the information 208 associated with the encrypted data object 206 . In still another of these embodiments, the access control management system 202 verifies that a user of the third client device 102 c is identified in the received information associated with the encrypted data object.
- the access control management system 202 authenticates the user of the third client device 102 c with a second identity provider 204 b . In yet another of these embodiments, the access control management system 202 sends the received information 208 associated with the encrypted data object 206 to the authenticated user of the third client device 102 c.
- the system 200 may include a plurality of access control management systems 202 a - n .
- the user of the first client device 102 a selects different access control management systems 202 for different recipients of the encrypted data object 206 .
- a second access control management system 202 b receives, from the first client device 102 a , information 208 associated with the encrypted data object 206 .
- the second access control management system 202 b receives, from a third client device 102 c , a request for the information 208 associated with the encrypted data object 206 .
- the second access control management system 202 b verifies that a user of the third client device 102 c is identified in the received information 208 associated with the encrypted data object 206 ; for example, the second access control management system 202 b may verify that the user of the third client device 102 is identified in the received information 208 as described above in connection with FIG. 3 ( 306 ). In another of these embodiments, the second access control management system 202 b authenticates the user of the third client device 102 c ; for example, the second access control management system 202 b may authenticate the user of the third client device 102 as described above in connection with FIG. 3 ( 308 ).
- the second access control management system 202 b authenticates the user of the third client device 102 c with the identity provider 204 . In another embodiment, the second access control management system 202 b authenticates the user of the third client device 102 c with a second identity provider 204 b . In yet another of these embodiments, the second access control management system 202 b sends, to the third client device 102 c , the received information 208 associated with the encrypted data object 206 ; for example, the second access control management system 202 b may authenticate the user of the third client device 102 as described above in connection with FIG. 3 ( 310 ).
- the method 400 includes generating, by a first client device, (i) an encrypted data object and (ii) information associated with the encrypted data object ( 402 ).
- the method 400 includes selecting, by the first client device, one of a plurality of remote access control management systems ( 404 ).
- the method 400 includes transmitting, by the first client device, to the selected one of the plurality of remote access control management systems, the information associated with the encrypted data object ( 406 ).
- the method 400 includes transmitting, by the first client device, to a second client device, the encrypted data object ( 408 ).
- the method 400 includes requesting, by the second client device, from the selected one of the plurality of remote access control management systems, the information associated with the encrypted data object ( 410 ).
- the method 400 includes verifying, by the selected one of the plurality of remote access control management systems, that a user of the second client device is authorized to receive the information associated with the encrypted data object ( 412 ).
- the method 400 includes authenticating the user of the second client device ( 414 )
- the method 400 includes transmitting, by the selected one of the plurality of remote access control management systems, to the second client device, the information associated with the encrypted data object ( 416 ).
- the method 400 includes decrypting, by the second client device, the encrypted data object with the information associated with the encrypted data object ( 418 ).
- the first client device 102 a generates (i) an encrypted data object 206 and (ii) information 208 associated with the encrypted data object 206 ( 402 ).
- a user of the first client device 102 a executes the secure object information generator 210 to encrypt a data object, generating the encrypted data object 206 , and to generate the information 208 associated with the encrypted data object 206 .
- the secure object information generator 210 provides an interface with which a user of the first client device 102 a may specify approved recipients of the information 208 ; for example, the secure object information generator 210 may provide a graphical user interface into which the user may type the email addresses or other identifying information for each approved recipient.
- the first client device 102 a selects one of a plurality of remote access control management systems 202 ( 404 ).
- the secure object information generator 210 executing on the first client device 102 a stores an identification of available access control management systems 202 .
- the user of the first client device 102 a identifies an access control management system 202 for use.
- the user of the first client device 102 a may customize the identification of available access control management systems 202 (e.g., by adding, removing, or otherwise modifying the access control management systems 202 included in the identification).
- an access control management system 202 provides an identification with which the user of the first client device 102 a may customize the identification of available access control management systems 202 (e.g., by publishing a uniform resource locator).
- the first client device 102 a transmits, to the selected one of the plurality of remote access control management systems 202 , the information 208 associated with the encrypted data object 206 ( 406 ).
- the secure object information generator 210 transmits the information 208 to the selected access control management system 202 .
- the access control management system 202 receives the information 208 as described above in connection with FIG. 3 ( 302 ).
- the first client device 102 a transmits, to a second client device 102 b , the encrypted data object 206 ( 408 ).
- the user of the first computing device 102 a may distribute the encrypted data object 206 by any method including, by way of example and without limitation, attaching it to emails, sending it to a “cloud-based” service (e.g., storing the encrypted data object 206 with a third-party service for sharing and storing files), and posting it on a website.
- a “cloud-based” service e.g., storing the encrypted data object 206 with a third-party service for sharing and storing files
- existing email systems are used to email the encrypted data object 206 as an attachment to an email.
- an email system is used to send an email with the encrypted data object 206 when the email system supporting the encrypted data object 206 as a valid email body type; for example, existing email systems may be modified to recognize the email body type via an update or an extension, such as an add-on or plug-in functionality.
- the second client device 102 b requests, from the selected one of the plurality of remote access control management systems 202 , the information associated with the encrypted data object 206 ( 410 ).
- the access control management system 202 receives the request as described above in connection with FIG. 3 ( 304 ).
- the selected one of the plurality of remote access control management systems 202 verifies that a user of the second client device 102 b is authorized to receive the information 208 associated with the encrypted data object 206 ( 412 ). In one embodiment, the access control management system 202 verifies the user as described above in connection with FIG. 3 ( 306 ).
- the selected one of the plurality of remote access control management systems 202 authenticates the user of the second client device 102 b ( 414 ).
- the access control management system 202 authenticates the user as described above in connection with FIG. 3 ( 308 ).
- the selected one of the plurality of remote access control management systems 202 transmits, to the second client device 102 b , the information associated with the encrypted data object 206 ( 416 ).
- the access control management system 202 sends the information 208 as described above in connection with FIG. 3 ( 310 ).
- the second client device 102 b decrypts the encrypted data object 206 with the information 208 associated with the encrypted data object 206 ( 416 ).
- the secure object information reader 212 executing on the second client device 102 b decrypts the encrypted data object 206 .
- the first client device 102 a selects a second of the plurality of remote access control management systems 202 and transmits the information 208 associated with the encrypted data object 206 to the selected second of the plurality of remote access control management systems 202 . In one of these embodiments, the first client device 102 a transmits the encrypted data object 206 to a third client device 102 c . In another of these embodiments, the third client device 102 c requests, from the selected second access control management system 202 b , the information 208 associated with the encrypted data object 206 .
- the selected second access control management system 202 verifies that a user of the third client device 102 c is authorized to receive the information 208 associated with the encrypted data object 206 and authenticates the user. In still another of these embodiments, the selected second access control management system 202 b transmits, to the third client device 102 c , the information 208 associated with the encrypted data object 206 . The third client device 102 c decrypts the encrypted data object 206 with the information 208 associated with the encrypted data object 206 .
- the methods and systems described herein provide functionality for electronic file protection.
- implementation of the methods and systems described herein provides functionality for coupling an access control management system with an identity provider, improving the ability of the access control management system to authenticate individuals requesting access to cryptographic data.
- implementation of the methods and systems described herein provides functionality for decoupling an access control management system from a storage system, reducing a storage burden on the access control management system and increasing the flexibility the system provides to users who benefit from a decentralized storage system.
- implementation of the methods and systems described herein provides functionality for users to share encrypted data objects with individuals who do not have a pre-existing trust relationship with an access control management system or who have a pre-existing trust relationship with an access control management system other than the one used by the distributing user.
- implementation of the methods and systems described herein provides functionality for creating secure data objects with access rights that are managed by an access control management system while authentication services are provided by a third-party identity provider.
- implementations of the methods and systems described herein allow consumers to exchange data securely using means with which typical computer users are familiar (i.e., email addresses and account passwords) to control (with a high degree of assurance and flexibility) access to the exchanged data.
- the systems and methods described above may be implemented as a method, apparatus or article of manufacture using programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof.
- the techniques described above may be implemented in one or more computer programs executing on a programmable computer including a processor, a storage medium readable by the processor (including, for example, volatile and non-volatile memory and/or storage elements), at least one input device, and at least one output device.
- Program code may be applied to input entered using the input device to perform the functions described and to generate output.
- the output may be provided to one or more output devices.
- Each computer program within the scope of the claims below may be implemented in any programming language, such as assembly language, machine language, a high-level procedural programming language, or an object-oriented programming language.
- the programming language may, for example, be LISP, PROLOG, PERL, C, C++, C#, JAVA, or any compiled or interpreted programming language.
- Each such computer program may be implemented in a computer program product tangibly embodied in a machine-readable storage device for execution by a computer processor.
- Method steps of the invention may be performed by a computer processor executing a program tangibly embodied on a computer-readable medium to perform functions of the invention by operating on input and generating output.
- Suitable processors include, by way of example, both general and special purpose microprocessors.
- the processor receives instructions and data from a read-only memory and/or a random access memory.
- Storage devices suitable for tangibly embodying computer program instructions include, for example, all forms of computer-readable devices, firmware, programmable logic, hardware (e.g., integrated circuit chip, electronic devices, a computer-readable non-volatile storage unit, non-volatile memory, such as semiconductor memory devices, including EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROMs. Any of the foregoing may be supplemented by, or incorporated in, specially-designed ASICs (application-specific integrated circuits) or FPGAs (Field-Programmable Gate Arrays).
- a computer can generally also receive programs and data from a storage medium such as an internal disk (not shown) or a removable disk.
- a computer may also receive programs and data from a second computer providing access to the programs via a network transmission line, wireless transmission media, signals propagating through space, radio waves, infrared signals, etc.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Signal Processing (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Databases & Information Systems (AREA)
- Multimedia (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Technology Law (AREA)
- Storage Device Security (AREA)
- Information Transfer Between Computers (AREA)
- Small-Scale Networks (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Description
Claims (19)
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/340,732 US8589673B2 (en) | 2011-01-12 | 2011-12-30 | Methods and systems for distributing cryptographic data to authenticated recipients |
US14/064,274 US8874902B2 (en) | 2011-01-12 | 2013-10-28 | Methods and systems for distributing cryptographic data to authenticated recipients |
US14/489,604 US9225709B2 (en) | 2011-01-12 | 2014-09-18 | Methods and systems for distributing cryptographic data to trusted recipients |
US14/949,087 US9578021B2 (en) | 2011-01-12 | 2015-11-23 | Methods and systems for distributing cryptographic data to authenticated recipients |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201161432181P | 2011-01-12 | 2011-01-12 | |
US13/340,732 US8589673B2 (en) | 2011-01-12 | 2011-12-30 | Methods and systems for distributing cryptographic data to authenticated recipients |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/064,274 Continuation US8874902B2 (en) | 2011-01-12 | 2013-10-28 | Methods and systems for distributing cryptographic data to authenticated recipients |
Publications (2)
Publication Number | Publication Date |
---|---|
US20120179905A1 US20120179905A1 (en) | 2012-07-12 |
US8589673B2 true US8589673B2 (en) | 2013-11-19 |
Family
ID=46456143
Family Applications (4)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/340,732 Active US8589673B2 (en) | 2011-01-12 | 2011-12-30 | Methods and systems for distributing cryptographic data to authenticated recipients |
US14/064,274 Active US8874902B2 (en) | 2011-01-12 | 2013-10-28 | Methods and systems for distributing cryptographic data to authenticated recipients |
US14/489,604 Active US9225709B2 (en) | 2011-01-12 | 2014-09-18 | Methods and systems for distributing cryptographic data to trusted recipients |
US14/949,087 Active US9578021B2 (en) | 2011-01-12 | 2015-11-23 | Methods and systems for distributing cryptographic data to authenticated recipients |
Family Applications After (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/064,274 Active US8874902B2 (en) | 2011-01-12 | 2013-10-28 | Methods and systems for distributing cryptographic data to authenticated recipients |
US14/489,604 Active US9225709B2 (en) | 2011-01-12 | 2014-09-18 | Methods and systems for distributing cryptographic data to trusted recipients |
US14/949,087 Active US9578021B2 (en) | 2011-01-12 | 2015-11-23 | Methods and systems for distributing cryptographic data to authenticated recipients |
Country Status (8)
Country | Link |
---|---|
US (4) | US8589673B2 (en) |
EP (4) | EP2996060B1 (en) |
JP (1) | JP2014506074A (en) |
AU (3) | AU2011354630C1 (en) |
CA (1) | CA2821916C (en) |
IN (1) | IN2013MN01198A (en) |
PL (1) | PL2664098T3 (en) |
WO (1) | WO2012096791A2 (en) |
Cited By (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20130251139A1 (en) * | 2009-01-28 | 2013-09-26 | Mark J. Williams | Communication system for establishing automated call back using queues |
US20150026483A1 (en) * | 2013-07-17 | 2015-01-22 | Marvell World Trade Ltd. | Systems and Methods for Mobile Application Protection |
US9083529B1 (en) | 2012-07-16 | 2015-07-14 | Wickr Inc. | Multi party messaging |
US9584530B1 (en) | 2014-06-27 | 2017-02-28 | Wickr Inc. | In-band identity verification and man-in-the-middle defense |
US9584493B1 (en) | 2015-12-18 | 2017-02-28 | Wickr Inc. | Decentralized authoritative messaging |
US9591479B1 (en) | 2016-04-14 | 2017-03-07 | Wickr Inc. | Secure telecommunications |
US9590958B1 (en) | 2016-04-14 | 2017-03-07 | Wickr Inc. | Secure file transfer |
US20170099268A1 (en) * | 2015-10-01 | 2017-04-06 | International Business Machines Corporation | Encrypted message communication |
US9654288B1 (en) | 2014-12-11 | 2017-05-16 | Wickr Inc. | Securing group communications |
US9698976B1 (en) | 2014-02-24 | 2017-07-04 | Wickr Inc. | Key management and dynamic perfect forward secrecy |
US9830089B1 (en) | 2013-06-25 | 2017-11-28 | Wickr Inc. | Digital data sanitization |
US9866591B1 (en) | 2013-06-25 | 2018-01-09 | Wickr Inc. | Enterprise messaging platform |
US9998600B2 (en) | 2012-10-19 | 2018-06-12 | Virtual Hold Technology, Llc | Managing, directing, and queuing communication events using near-field communications |
US10129260B1 (en) | 2013-06-25 | 2018-11-13 | Wickr Inc. | Mutual privacy management |
US10291607B1 (en) | 2016-02-02 | 2019-05-14 | Wickr Inc. | Providing real-time events to applications |
US10567349B2 (en) | 2013-06-25 | 2020-02-18 | Wickr Inc. | Secure time-to-live |
Families Citing this family (39)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10255419B1 (en) * | 2009-06-03 | 2019-04-09 | James F. Kragh | Identity validation and verification system and associated methods |
US9576046B2 (en) | 2011-11-16 | 2017-02-21 | Ptc Inc. | Methods for integrating semantic search, query, and analysis across heterogeneous data types and devices thereof |
US12072989B2 (en) * | 2011-12-09 | 2024-08-27 | Sertainty Corporation | System and methods for using cipher objects to protect data |
US20150199534A1 (en) * | 2012-07-12 | 2015-07-16 | Md Databank Corp | Secure Storage System and Uses Thereof |
US10250579B2 (en) * | 2013-08-13 | 2019-04-02 | Alcatel Lucent | Secure file transfers within network-based storage |
US9473506B1 (en) | 2013-10-15 | 2016-10-18 | Progress Software Corporation | Secure file transfer and notification server |
US9531678B1 (en) | 2013-10-15 | 2016-12-27 | Progress Software Corporation | On-premises data access and firewall tunneling |
US20160019715A1 (en) * | 2014-07-15 | 2016-01-21 | Osterhout Group, Inc. | Content presentation in head worn computing |
US10313410B2 (en) | 2014-03-21 | 2019-06-04 | Ptc Inc. | Systems and methods using binary dynamic rest messages |
US9462085B2 (en) | 2014-03-21 | 2016-10-04 | Ptc Inc. | Chunk-based communication of binary dynamic rest messages |
WO2015143416A1 (en) | 2014-03-21 | 2015-09-24 | Ptc Inc. | Systems and methods for developing and using real-time data applications |
US9350791B2 (en) | 2014-03-21 | 2016-05-24 | Ptc Inc. | System and method of injecting states into message routing in a distributed computing environment |
US9762637B2 (en) | 2014-03-21 | 2017-09-12 | Ptc Inc. | System and method of using binary dynamic rest messages |
US20150271271A1 (en) * | 2014-03-21 | 2015-09-24 | Ptc Inc. | System and method of using dynamic rest messages with web-sockets |
US9961058B2 (en) | 2014-03-21 | 2018-05-01 | Ptc Inc. | System and method of message routing via connection servers in a distributed computing environment |
US9560170B2 (en) | 2014-03-21 | 2017-01-31 | Ptc Inc. | System and method of abstracting communication protocol using self-describing messages |
US9350812B2 (en) | 2014-03-21 | 2016-05-24 | Ptc Inc. | System and method of message routing using name-based identifier in a distributed computing environment |
US9710659B2 (en) * | 2014-08-28 | 2017-07-18 | Virtru Corporation | Methods and systems for enforcing, by a kernel driver, a usage restriction associated with encrypted data |
CN104460434A (en) * | 2014-11-11 | 2015-03-25 | 青岛龙泰天翔通信科技有限公司 | Security protection information processing terminal |
US11023117B2 (en) * | 2015-01-07 | 2021-06-01 | Byron Burpulis | System and method for monitoring variations in a target web page |
US11088834B2 (en) * | 2015-04-28 | 2021-08-10 | Palo Alto Research Center Incorporated | System for privacy-preserving monetization of big data and method for using the same |
KR101728878B1 (en) * | 2015-05-08 | 2017-05-02 | (주)케이사인 | Personal information transfer system |
US10437525B2 (en) * | 2015-05-27 | 2019-10-08 | California Institute Of Technology | Communication efficient secret sharing |
US10523646B2 (en) | 2015-08-24 | 2019-12-31 | Virtru Corporation | Methods and systems for distributing encrypted cryptographic data |
US20170339140A1 (en) * | 2016-05-18 | 2017-11-23 | Barry Corel Sudduth | Biometric authentication system and method |
US10579495B2 (en) | 2017-05-18 | 2020-03-03 | California Institute Of Technology | Systems and methods for transmitting data using encoder cooperation in the presence of state information |
JP6729518B2 (en) * | 2017-08-25 | 2020-07-22 | トヨタ自動車株式会社 | Self-driving vehicle and driverless transportation system |
US10616182B1 (en) | 2017-11-30 | 2020-04-07 | Progress Software Corporation | Data access and firewall tunneling using a custom socket factory |
US10949569B2 (en) * | 2018-10-17 | 2021-03-16 | International Business Machines Corporation | Adaptive on-device storage management across multiple applications |
US11531777B2 (en) | 2019-01-30 | 2022-12-20 | Virtru Corporation | Methods and systems for restricting data access based on properties of at least one of a process and a machine executing the process |
US11329968B2 (en) * | 2019-03-18 | 2022-05-10 | Microsoft Technology Licensing, Llc | Authentication across decentralized and centralized identities |
US11245727B2 (en) * | 2019-05-16 | 2022-02-08 | International Business Machines Corporation | Adaptive identity broker for governance of decentralized identities across multiple heterogeneous identity networks |
US11394718B2 (en) * | 2019-06-10 | 2022-07-19 | Microsoft Technology Licensing, Llc | Resolving decentralized identifiers using multiple resolvers |
US11711357B2 (en) * | 2019-08-16 | 2023-07-25 | Netflix, Inc. | Identity data object creation and management |
US11363032B2 (en) | 2019-08-22 | 2022-06-14 | Microsoft Technology Licensing, Llc | Resolving decentralized identifiers at customized security levels |
US11258779B2 (en) * | 2020-01-14 | 2022-02-22 | Cisco Technology, Inc. | Wireless LAN (WLAN) public identity federation trust architecture |
US10873852B1 (en) | 2020-04-10 | 2020-12-22 | Avila Technology, LLC | POOFster: a secure mobile text message and object sharing application, system, and method for same |
US11151229B1 (en) | 2020-04-10 | 2021-10-19 | Avila Technology, LLC | Secure messaging service with digital rights management using blockchain technology |
US20220414244A1 (en) * | 2021-06-23 | 2022-12-29 | International Business Machines Corporation | Sender-based consent mechanism for sharing images |
Citations (18)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030149781A1 (en) * | 2001-12-04 | 2003-08-07 | Peter Yared | Distributed network identity |
US20040034776A1 (en) | 2002-08-14 | 2004-02-19 | Microsoft Corporation | Authenticating peer-to-peer connections |
US20040186997A1 (en) | 2003-01-31 | 2004-09-23 | Canon Kabushiki Kaisha | Encrypted data sharing system and encrypted data sharing method |
US20070074270A1 (en) | 2005-09-28 | 2007-03-29 | Essential Security Software, Inc. | Method and system for digital rights management of documents |
US20070118735A1 (en) | 2005-11-10 | 2007-05-24 | Jeff Cherrington | Systems and methods for trusted information exchange |
US20080005024A1 (en) | 2006-05-17 | 2008-01-03 | Carter Kirkwood | Document authentication system |
US20080086646A1 (en) * | 2006-10-05 | 2008-04-10 | Ceelox, Inc. | System and method of secure encryption for electronic data transfer |
US20080151110A1 (en) | 2006-12-26 | 2008-06-26 | Fujitsu Limited | System for receiving and storing broadcast content, and device for reception and storage |
US20090055924A1 (en) | 2006-07-19 | 2009-02-26 | Trotter Douglas H | Trusted records using secure exchange |
US20090106549A1 (en) | 2007-10-20 | 2009-04-23 | Blackout, Inc. | Method and system for extending encrypting file system |
US20100153739A1 (en) | 2008-12-15 | 2010-06-17 | Guymon Jr John Lewis | Securable independent electronic document |
US7774411B2 (en) | 2003-12-12 | 2010-08-10 | Wisys Technology Foundation, Inc. | Secure electronic message transport protocol |
US7844832B2 (en) | 2005-11-29 | 2010-11-30 | Nation Ron L | System and method for data source authentication and protection system using biometrics for openly exchanged computer files |
US20110040967A1 (en) | 2009-02-06 | 2011-02-17 | Thales Holdings Uk Plc | System and Method for Multilevel Secure Object Management |
US20110040964A1 (en) | 2007-12-21 | 2011-02-17 | Lawrence Edward Nussbaum | System and method for securing data |
US7913311B2 (en) | 2001-12-12 | 2011-03-22 | Rossmann Alain | Methods and systems for providing access control to electronic data |
US7921450B1 (en) | 2001-12-12 | 2011-04-05 | Klimenty Vainstein | Security system using indirect key generation from access rules and methods therefor |
US7921288B1 (en) | 2001-12-12 | 2011-04-05 | Hildebrand Hal S | System and method for providing different levels of key security for controlling access to secured items |
Family Cites Families (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7155415B2 (en) * | 2000-04-07 | 2006-12-26 | Movielink Llc | Secure digital content licensing system and method |
WO2002056537A1 (en) * | 2001-01-09 | 2002-07-18 | Benninghoff Charles F Iii | Method for certifying and unifying delivery of electronic packages |
JP4599852B2 (en) * | 2004-02-23 | 2010-12-15 | ソニー株式会社 | Data communication apparatus and method, and program |
US8006100B2 (en) * | 2004-06-10 | 2011-08-23 | Oracle America, Inc. | Enhancing trusted platform module performance |
FR2884377B1 (en) * | 2005-04-06 | 2007-07-20 | Viaccess Sa | METHOD FOR AUTHENTICATING A USER OF DIGITAL CONTENT |
US7805375B2 (en) * | 2005-08-22 | 2010-09-28 | Microsoft Corporation | Digital license migration from first platform to second platform |
JP5181094B2 (en) * | 2006-05-05 | 2013-04-10 | インターデイジタル テクノロジー コーポレーション | Digital rights management using trusted processing technology |
KR20080027037A (en) * | 2006-09-22 | 2008-03-26 | 삼성전자주식회사 | Apparatus and method for transmitting/receiving right object of contents between devices, and the system thereof |
KR101434402B1 (en) * | 2007-06-09 | 2014-08-27 | 삼성전자주식회사 | Method and apparatus for obtaining right objects of contents in a mobile terminal |
US7913309B2 (en) * | 2007-06-13 | 2011-03-22 | Microsoft Corporation | Information rights management |
KR20100088966A (en) * | 2009-02-02 | 2010-08-11 | 삼성전자주식회사 | Method for playing drm contents and managing of license in a portable device and a apparatus therefor |
-
2011
- 2011-12-30 US US13/340,732 patent/US8589673B2/en active Active
- 2011-12-30 EP EP15191773.9A patent/EP2996060B1/en active Active
- 2011-12-30 PL PL11855869T patent/PL2664098T3/en unknown
- 2011-12-30 EP EP20190358.0A patent/EP3754532A1/en active Pending
- 2011-12-30 WO PCT/US2011/068019 patent/WO2012096791A2/en active Application Filing
- 2011-12-30 CA CA2821916A patent/CA2821916C/en active Active
- 2011-12-30 JP JP2013549435A patent/JP2014506074A/en active Pending
- 2011-12-30 AU AU2011354630A patent/AU2011354630C1/en active Active
- 2011-12-30 EP EP17187647.7A patent/EP3279825B1/en active Active
- 2011-12-30 EP EP11855869.1A patent/EP2664098B1/en active Active
-
2013
- 2013-06-20 IN IN1198MUN2013 patent/IN2013MN01198A/en unknown
- 2013-10-28 US US14/064,274 patent/US8874902B2/en active Active
-
2014
- 2014-09-18 US US14/489,604 patent/US9225709B2/en active Active
-
2015
- 2015-11-23 US US14/949,087 patent/US9578021B2/en active Active
-
2016
- 2016-03-04 AU AU2016201462A patent/AU2016201462B2/en active Active
-
2017
- 2017-08-28 AU AU2017219140A patent/AU2017219140B2/en active Active
Patent Citations (18)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030149781A1 (en) * | 2001-12-04 | 2003-08-07 | Peter Yared | Distributed network identity |
US7921288B1 (en) | 2001-12-12 | 2011-04-05 | Hildebrand Hal S | System and method for providing different levels of key security for controlling access to secured items |
US7921450B1 (en) | 2001-12-12 | 2011-04-05 | Klimenty Vainstein | Security system using indirect key generation from access rules and methods therefor |
US7913311B2 (en) | 2001-12-12 | 2011-03-22 | Rossmann Alain | Methods and systems for providing access control to electronic data |
US20040034776A1 (en) | 2002-08-14 | 2004-02-19 | Microsoft Corporation | Authenticating peer-to-peer connections |
US20040186997A1 (en) | 2003-01-31 | 2004-09-23 | Canon Kabushiki Kaisha | Encrypted data sharing system and encrypted data sharing method |
US7774411B2 (en) | 2003-12-12 | 2010-08-10 | Wisys Technology Foundation, Inc. | Secure electronic message transport protocol |
US20070074270A1 (en) | 2005-09-28 | 2007-03-29 | Essential Security Software, Inc. | Method and system for digital rights management of documents |
US20070118735A1 (en) | 2005-11-10 | 2007-05-24 | Jeff Cherrington | Systems and methods for trusted information exchange |
US7844832B2 (en) | 2005-11-29 | 2010-11-30 | Nation Ron L | System and method for data source authentication and protection system using biometrics for openly exchanged computer files |
US20080005024A1 (en) | 2006-05-17 | 2008-01-03 | Carter Kirkwood | Document authentication system |
US20090055924A1 (en) | 2006-07-19 | 2009-02-26 | Trotter Douglas H | Trusted records using secure exchange |
US20080086646A1 (en) * | 2006-10-05 | 2008-04-10 | Ceelox, Inc. | System and method of secure encryption for electronic data transfer |
US20080151110A1 (en) | 2006-12-26 | 2008-06-26 | Fujitsu Limited | System for receiving and storing broadcast content, and device for reception and storage |
US20090106549A1 (en) | 2007-10-20 | 2009-04-23 | Blackout, Inc. | Method and system for extending encrypting file system |
US20110040964A1 (en) | 2007-12-21 | 2011-02-17 | Lawrence Edward Nussbaum | System and method for securing data |
US20100153739A1 (en) | 2008-12-15 | 2010-06-17 | Guymon Jr John Lewis | Securable independent electronic document |
US20110040967A1 (en) | 2009-02-06 | 2011-02-17 | Thales Holdings Uk Plc | System and Method for Multilevel Secure Object Management |
Non-Patent Citations (4)
Title |
---|
Erol Koc, et al., "PACISSO: P2P Access Control Incorporating Scalability and Self-Organization for Storage Systems," SMLI TR-2007-154, Sun Microsystems, Jun. 2007. |
International Search Report and Written Opinion for PCT/US2011/068019, mailed Aug. 30, 2012, 9 pages. |
Nobelis et al., "Decentralized Access Right Management for Workflow Applications," 2005, https://nyx.unice.fr/publis/nobelis-boudaoud-etal:2005.pdf. |
Ravi Sandhu et al., "Peer-to-Peer Access Control Architecture using Trusted Computing Technology," ACM, SACMAT'05, Jun. 1-3, 2005, Stockholm, Sweden, 2005. |
Cited By (47)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9398154B2 (en) * | 2009-01-28 | 2016-07-19 | Virtual Hold Technology, Llc | Communication system for establishing automated call back using queues |
US9942403B2 (en) | 2009-01-28 | 2018-04-10 | Virtual Hold Technology, Llc | Communication system for determining queue using contextual data |
US9992340B2 (en) | 2009-01-28 | 2018-06-05 | Virtual Hold Technology, Llc | Communication system for establishing automated call back using queues |
US20130251139A1 (en) * | 2009-01-28 | 2013-09-26 | Mark J. Williams | Communication system for establishing automated call back using queues |
US9386155B2 (en) | 2009-01-28 | 2016-07-05 | Virtual Hold Technology, Llc | Communication device for establishing automated call back using queues |
US11159310B2 (en) | 2012-07-16 | 2021-10-26 | Amazon Technologies, Inc. | Digital security bubble |
US9628449B1 (en) | 2012-07-16 | 2017-04-18 | Wickr Inc. | Multi party messaging |
US9584316B1 (en) | 2012-07-16 | 2017-02-28 | Wickr Inc. | Digital security bubble |
US10038677B1 (en) | 2012-07-16 | 2018-07-31 | Wickr Inc. | Digital security bubble |
US9876772B1 (en) | 2012-07-16 | 2018-01-23 | Wickr Inc. | Encrypting and transmitting data |
US9729315B2 (en) | 2012-07-16 | 2017-08-08 | Wickr Inc. | Initialization and registration of an application |
US9285981B1 (en) | 2012-07-16 | 2016-03-15 | Wickr Inc. | Discouraging screen capture |
US10659435B2 (en) | 2012-07-16 | 2020-05-19 | Wickr Inc. | Multi party messaging |
US10635289B1 (en) | 2012-07-16 | 2020-04-28 | Wickr Inc. | Discouraging screen capture |
US9083529B1 (en) | 2012-07-16 | 2015-07-14 | Wickr Inc. | Multi party messaging |
US10432597B1 (en) | 2012-07-16 | 2019-10-01 | Wickr Inc. | Digital security bubble |
US10248799B1 (en) | 2012-07-16 | 2019-04-02 | Wickr Inc. | Discouraging screen capture |
US9667417B1 (en) | 2012-07-16 | 2017-05-30 | Wickr Inc. | Digital security bubble |
US10581817B1 (en) | 2012-07-16 | 2020-03-03 | Wickr Inc. | Digital security bubble |
US9998600B2 (en) | 2012-10-19 | 2018-06-12 | Virtual Hold Technology, Llc | Managing, directing, and queuing communication events using near-field communications |
US11924361B1 (en) | 2013-06-25 | 2024-03-05 | Amazon Technologies, Inc. | Secure time-to-live |
US10129260B1 (en) | 2013-06-25 | 2018-11-13 | Wickr Inc. | Mutual privacy management |
US9830089B1 (en) | 2013-06-25 | 2017-11-28 | Wickr Inc. | Digital data sanitization |
US9866591B1 (en) | 2013-06-25 | 2018-01-09 | Wickr Inc. | Enterprise messaging platform |
US10567349B2 (en) | 2013-06-25 | 2020-02-18 | Wickr Inc. | Secure time-to-live |
US11509488B2 (en) | 2013-06-25 | 2022-11-22 | Amazon Technologies, Inc. | Secure time-to-live |
US20150026483A1 (en) * | 2013-07-17 | 2015-01-22 | Marvell World Trade Ltd. | Systems and Methods for Mobile Application Protection |
US9698976B1 (en) | 2014-02-24 | 2017-07-04 | Wickr Inc. | Key management and dynamic perfect forward secrecy |
US10396982B1 (en) | 2014-02-24 | 2019-08-27 | Wickr Inc. | Key management and dynamic perfect forward secrecy |
US10382197B1 (en) | 2014-02-24 | 2019-08-13 | Wickr Inc. | Key management and dynamic perfect forward secrecy |
US9584530B1 (en) | 2014-06-27 | 2017-02-28 | Wickr Inc. | In-band identity verification and man-in-the-middle defense |
US9654288B1 (en) | 2014-12-11 | 2017-05-16 | Wickr Inc. | Securing group communications |
US20170099268A1 (en) * | 2015-10-01 | 2017-04-06 | International Business Machines Corporation | Encrypted message communication |
US10356058B2 (en) * | 2015-10-01 | 2019-07-16 | International Business Machines Corporation | Encrypted message communication |
US9590956B1 (en) | 2015-12-18 | 2017-03-07 | Wickr Inc. | Decentralized authoritative messaging |
US10142300B1 (en) | 2015-12-18 | 2018-11-27 | Wickr Inc. | Decentralized authoritative messaging |
US10129187B1 (en) | 2015-12-18 | 2018-11-13 | Wickr Inc. | Decentralized authoritative messaging |
US9673973B1 (en) | 2015-12-18 | 2017-06-06 | Wickr Inc. | Decentralized authoritative messaging |
US9584493B1 (en) | 2015-12-18 | 2017-02-28 | Wickr Inc. | Decentralized authoritative messaging |
US10291607B1 (en) | 2016-02-02 | 2019-05-14 | Wickr Inc. | Providing real-time events to applications |
US9805212B1 (en) | 2016-04-14 | 2017-10-31 | Wickr Inc. | Secure file transfer |
US9602477B1 (en) | 2016-04-14 | 2017-03-21 | Wickr Inc. | Secure file transfer |
US9596079B1 (en) | 2016-04-14 | 2017-03-14 | Wickr Inc. | Secure telecommunications |
US9590958B1 (en) | 2016-04-14 | 2017-03-07 | Wickr Inc. | Secure file transfer |
US11362811B2 (en) | 2016-04-14 | 2022-06-14 | Amazon Technologies, Inc. | Secure telecommunications |
US11405370B1 (en) | 2016-04-14 | 2022-08-02 | Amazon Technologies, Inc. | Secure file transfer |
US9591479B1 (en) | 2016-04-14 | 2017-03-07 | Wickr Inc. | Secure telecommunications |
Also Published As
Publication number | Publication date |
---|---|
EP2664098B1 (en) | 2015-12-30 |
US20150006884A1 (en) | 2015-01-01 |
CA2821916C (en) | 2018-11-20 |
EP2664098A2 (en) | 2013-11-20 |
AU2016201462A1 (en) | 2016-03-24 |
US20140052982A1 (en) | 2014-02-20 |
WO2012096791A8 (en) | 2012-09-20 |
EP2996060A2 (en) | 2016-03-16 |
WO2012096791A3 (en) | 2012-11-08 |
US9578021B2 (en) | 2017-02-21 |
WO2012096791A2 (en) | 2012-07-19 |
PL2664098T3 (en) | 2016-05-31 |
AU2011354630C1 (en) | 2016-03-24 |
EP2996060B1 (en) | 2017-10-04 |
AU2017219140A1 (en) | 2017-09-14 |
US20120179905A1 (en) | 2012-07-12 |
CA2821916A1 (en) | 2012-07-19 |
IN2013MN01198A (en) | 2015-06-12 |
JP2014506074A (en) | 2014-03-06 |
EP3279825A1 (en) | 2018-02-07 |
EP2996060A3 (en) | 2016-05-11 |
US20160119335A1 (en) | 2016-04-28 |
US9225709B2 (en) | 2015-12-29 |
AU2011354630B2 (en) | 2015-12-10 |
AU2011354630A1 (en) | 2013-07-11 |
US8874902B2 (en) | 2014-10-28 |
EP3754532A1 (en) | 2020-12-23 |
EP2664098A4 (en) | 2014-09-17 |
AU2017219140B2 (en) | 2019-08-29 |
AU2016201462B2 (en) | 2017-06-22 |
EP3279825B1 (en) | 2020-09-30 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
AU2017219140B2 (en) | Methods and systems for distributing cryptographic data to authenticated recipients | |
US11196729B2 (en) | Methods and systems for distributing encrypted cryptographic data | |
US9710659B2 (en) | Methods and systems for enforcing, by a kernel driver, a usage restriction associated with encrypted data | |
US9577989B2 (en) | Methods and systems for decrypting an encrypted portion of a uniform resource identifier | |
US20130205360A1 (en) | Protecting user credentials from a computing device | |
CA2798024C (en) | One time passwords with ipsec and ike version 1 authentication | |
US10607025B2 (en) | Access control through data structures |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: VIRTRU CORPORATION, DISTRICT OF COLUMBIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ACKERLY, WILLIAM RODGERS;REEL/FRAME:030114/0566 Effective date: 20130321 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
CC | Certificate of correction | ||
FPAY | Fee payment |
Year of fee payment: 4 |
|
CC | Certificate of correction | ||
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |
|
CC | Certificate of correction | ||
AS | Assignment |
Owner name: SILICON VALLEY BANK, VIRGINIA Free format text: SECURITY INTEREST;ASSIGNOR:VIRTRU CORPORATION;REEL/FRAME:057718/0099 Effective date: 20211006 |
|
CC | Certificate of correction | ||
IPR | Aia trial proceeding filed before the patent and appeal board: inter partes review |
Free format text: TRIAL NO: IPR2023-00017 Opponent name: MICROSOFT CORPORATION Effective date: 20221103 |
|
AS | Assignment |
Owner name: STIFEL BANK, MISSOURI Free format text: SECURITY INTEREST;ASSIGNOR:VIRTRU CORPORATION;REEL/FRAME:066398/0565 Effective date: 20240206 |
|
AS | Assignment |
Owner name: VIRTRU CORPORATION, DISTRICT OF COLUMBIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:FIRST-CITIZENS BANK & TRUST COMPANY;REEL/FRAME:066412/0348 Effective date: 20240201 |